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VOLUME  II 
IN  THE  UNITED  STATES  ARMY 

UNITED  STATES 
VS. 

MANNING,    Bradley  E.,    PFC  COURT-MARTIAL 
U.S.   Army,    xxx— xx— 9504 

Headquarters  and  Headquarters  Company, 

U.S.   Army  Garrison, 

Joint  Base  Myer— Henderson  Hall, 

Fort  Myer,   VA  22211 

 / 

The  Hearing  in  the  above— titled  matter  was 
held  on  Tuesday,    June  4,    2013,   at  9:30  a.m.,  at 
Fort  Meade,   Maryland,   before  the  Honorable  Colonel 
Denise  Lind,  Judge. 
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DISCLAIMER 
This  transcript  was  made  by  a  court 
reporter  who  is  not  the  official  Government  reporter, 
was  not  permitted  to  be  in  the  actual  courtroom  where 
the  proceedings  took  place,   but  in  a  media  room 
listening  to  and  watching  live  audio/video  feed,  not 
permitted  to  make  an  audio  backup  recording  for  editing 
purposes,    and  not  having  the  ability  to  control  the 
proceedings  in  order  to  produce  an  accurate  verbatim 
transcript . 

This  unedited,    uncertified  draft  transcript 
may  contain  court  reporting  outlines  that  are  not 
translated,   notes  made  by  the  reporter  for  editing 
purposes,   misspelled  terms  and  names,   word  combinations 
that  do  not  make  sense,    and  missing  testimony  or 
colloquy  due  to  being  inaudible  by  the  reporter. 
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PROCEEDINGS  -  MORNING  SESSION 

THE  COURT :      Court  is  called  to  order .  Trial 
counsel,   please  account  for  parties. 

MR.   MORROW:     All  present  with  exception 
Captain  Overgaard. 

THE  COURT :     Any  issues  we  need  to  address 
before  we  proceed  today? 

MR.   COOMBS:     No,    Your  Honor.     David  Shaver. 

MR.   MORROW:     David  Shaver. 

Whereupon, 

DAVID  SHAVER, 

called  as  a  witness,  having  been  first  duly  sworn  to 
tell  the  truth,  the  whole  truth,  and  nothing  but  the 
truth,   was  examined  and  testified  as  follows : 

EXAMINATION  BY  MR.  MORROW 

BY  MR.  MORROW: 

Q.        You  are  Dave  Shaver,    Special  Agent,  special 
inspector   (inaudible)    for  the  (inaudible) 

A.        Yes,  sir. 

Q.        Special  Agent  Shaver,   how  long  have  you 
worked  for  (inaudible) 
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A.       For  about  a  year  and  a  half,  sir. 
Q.       What  do  you  (inaudible) 
A.       Special  agent. 

Q.        What  specifically,   what  kind  of  work  do  you 
do  as  special  agent? 

A.        Sir,   my  job  mainly  is  to  take  digital  media 
which  has  been  generated  as  part  of  a  search  warrant  or 
a  subpoena  and  turn  it  into  usable  format  in 
(inaudible) 

Q.        Explain  the  (inaudible)? 

A.        It's  special  (inaudible) 

Q.       Before  becoming  a  special  agent  with  the 
Department  of  Treasury,   what  did  you  do? 

A.        Sir,    I  was  the  special  agent  in  charge  for 
the  research  branch  of  Computer  Crime  Investigative 
Unit . 

Q.       What  is  the  Computer  Crime  Investigative 

Unit? 

A.        It ' s  a  unit  of  CCIU  main  focus  CCII  focus 
investigate  any  intrusion  computer    (inaudible)  in 
support  of  that  mission. 
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Q.        When  did  you  begin  working  for  Army  CCIU? 
A.        In  1999. 

Q.       Can  you  describe  your  process  throughout  the 
organization  there? 

A.        Yes,    sir.      In  1999  CCIU  as  enlisted  temp  and 
2001  I  left  the  army  and  2000  early  2002  I  came  back  to 
work  for  CCIU  as    (Inaudible) .      In  2003  I  became  a 
(Inaudible) . 

Q.        You  are  not  a  CCIU? 

A.        No,  sir. 

Q.  (Inaudible) 

A.  2005. 

Q.        Is  that  supervisory  position? 
A.        Yes,    it  is. 

Q.        How  many  people  did  you  supervise? 

A.        I  directly  supervised  five.      I  also  supported 
about  7  8  examiners  worldwide. 

Q.       What  kind  of  work  did  you  do  as  special  agent 
in  charge  of    (Inaudible) ? 

A.        Forensic  evidence  in  counter  intelligence 
minimum  I  also  policies  for  procedures  methods  and  also 
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(Inaudible) 

Q.       What  do  you  mean  by  tool  validation? 

A.        It's  concerning  digital    (inaudible)  tools. 
To  make  sure  the  forensic  program  actually  did  what  it 
was  supposed  to  do .     Not  what  it  was  supposed  to . 
Validated  the  findings . 

Q.        Do  you  have  any  formal  education? 

A.        Yes,    sir,    I  do. 

Q.        From  where? 

A.        (Inaudible) . 

Q.        What  was  your  major  there? 
A.        Sociology  criminology. 
Q.        Background  CV.      (Inaudible)    The  CV? 
A.        Simply  just  examination  after  digital  media. 
Q.       What  is  the  digital  media? 
THE  COURT :      Just  a  moment . 

MR .   HURLEY :     Accept  special  agent  as  expert 
in  computer  forensics. 

MR.   MORROW:  (Inaudible) 

THE  COURT :      That ' s  fine . 
BY  MR.  MORROW: 
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Q.        Special  Agent  shaver,   what  is  digital  media? 

A.        Digital  media  is   just  that.     Electronics  such 
as  cell  phone,   a  computer,   a  server,   any  cell  phone 
(Inaudible) . 

Q.        Did  you  receive  any  certifications? 

A.        Yes,  sir. 

Q.       What  are  those? 

A.        First  ones  the    (Inaudible) .  Specialist 
training  Georgia.      Certified  criminal  defense  center 
otherwise  DC3  Maryland.  (Inaudible) 

Q.       Have  you  published  any  articles  related  to 
computer  forensics? 

A.        Yes,    I  have. 

Q.       What  is  that? 

A.        In  2009  I  chapter  concerning  (Inaudible) 

Q.       Have  you  attended  any  conferences? 

A.        Yes,    sir,    I  have. 

Q.       What  are  those  conferences? 

A.        The  annual  Department  of  Defense  Conference 
and  the  Annual  Software  Conference . 

Q.       Did  you  ever  receive  any  awards  as  a  result 
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of  your  work? 

A.        Yes,    sir,    I  have.      In  2009    (inaudible)  award 
contribute  forensic  evidence,    from  the  International 
Chief  of  Police. 

Q.        What  was  that  award  for? 

A.        Two.     One  was    (inaudible)    and  criminal 
investigations  and  tool  to  examine  computers  to 
determine  (inaudible) 

Q.       What  do  you  mean  by  virtual? 

A.       Virtual  machine  in  this  case  we  would  take  a 
forensic  item  and  convert  it  into  machine  so  your 
computer  would  be  considered  the  host  and  the  first 
machine  would  be  the  guest .     The  guest  computer  can  be 
any  operating  system,   whether  it  be  MAC  or  Windows . 
The  advantage  of  this  is  to  see  the  computer  as  the 
person . 

Q.        (Inaudible)   to  see  the  computer  desktop? 
A.       Same  desktops,   wallpaper,    same  program.  It 
is  their  computer. 

Q.        Thank  you.     What  is  a  forensic  image? 

A.        The  forensic  image,    technically  computers  are 
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organized  spaced  lowest  level    (inaudible)  operating 
system  but  I  know  being  two  test  wheels .     And  that  it 
is  either  a  1  or  a  zero  that  is  called  a  bit .  So 
forensic  image  is  it's  bit  by  forensic  image. 
(Inaudible)   tool  would  be  the  first  zero  and  next  byte 
with  us  write  the  one.      Continue  to  do  this  until  media 
has  been  copied . 

Q.        You  said  forensic  item.     What  tool  is  — 

A.        I  used  EnCase  for  this  program. 

Q.       After  the  EnCase,   what  happens? 

A.        (Inaudible)   hash  value  and  you  think  hash 
value  digital  fingerprint . 

Q.        If  two  values  match,   what  does  that  tell  you? 

A.        They  are  the  exact  same  thing. 

Q.       Verified  hash  values.     What  is  the  next  step 
or  examining  the  computer? 

A.       The  next  step  would  be  to  answer  the 
questions  which  is  posed  by    (inaudible) . 

Q.        You  mentioned  EnCase.      Can  you  describe  what 
EnCase  is? 

A.       EnCase  is  basically  the  standard  used 
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throughout  the  market .     Used  by  both  government  and 
corporate  entities . 

Q.       And  who  owns  EnCase? 

A.        That's  a  company    (inaudible)    in  California. 
Q.        (Inaudible)   EnCase  to  examine  or  create 
images? 

A.        You  are  allowed  to  view  files  in  native 
format  without  altering  them.      Gives  you  the  ability  to 
(inaudible)    spaces  —    (inaudible) . 

Q.       Alright.     What  is  the  allocated  space? 

A.       Allocate  space  is  just  that,    files  that  are 
allocated.      If  you  create  a  folder  on  allocated.  It's 
there.     Unallocated  are  deleted  files  on  a  hard  drive 
never  been  used. 

Q.       You  said  allocate  has  never  been  used.  Does 
EnCase  or  tools  like  that,   do  they  allow  you  to  see 
deleted  files  or  files  that  may  have  existed  and  are 
now  gone? 

A.        Yes,  sir. 

Q.        Explain  that,  please. 

A.       Again,    if  you  think  of  a  computer  like  a 
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library.     You  want  to  find  a  certain  book.     You  go  to 
the  catalog.      It  will  tell  you  where  in  the  library  the 
book  is . 

In  a  computer  obviously  Windows  is 
something   (inaudible) .      If  you  would  like  to  view  a 
file,   the  operating  system  will  go  down  the  master  file 
table,    locate  where  on  the  hard  drive  the  file  is  and 
retrieve  it  for  you . 

So  when  you  delete  the  file,   all  you 
basically  do  is  remove  the  entry  from  the  master  file 
table  or  remove  the  card  from  the  catalog.      If  you  do 
that,   the  book  is  still  physically  in  the  library  but 
you  can't  access  it. 

Q.       When  you  say  the  book  is  still  in  the 
library,   with  the  data  still  on  the  computer,   are  you 
always  able  to  recover  the  full  file  or  partial  file? 

A.       Again,    once  the  computer  erases  the  file 
space  in  the  file  is  now  free  to  be  used  for  something 
else.      It's  free  to  use.      If  the  operating  system  needs 
to  write  something,    it  could  overwrite  part  or  all  of 
the  file. 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/4/13  Morning  Session 


Q.       What  do  you  mean  by  overwrite? 

A.        Use  the  space  for  another  file.      If  you 
download  some  movies,    it  needs  to  put  them  somewhere, 
it  may  overwrite  deleted  files . 

MR.   MORROW:     At  this  time  the  United  States 
offers  Special  Agent  Shaver  as  expert  in  computer 
f orensics . 

THE  COURT:  Alright. 

EXAMINATION  BY  HURLEY 

BY  MR.  HURLEY: 

Q.        Good  morning,   Mr.  Shaver. 
A.        Good  morning. 

Q.       You  talked  about  the  process  of  taking  a 
forensic  image .     You  would  agree  with  me  in  an 
investigation  that  you  are  doing  the  forensic 
examination,    you  are  going  to  document  things? 

A.        Yes,  sir. 

Q .        You ' re  going  to  have  guidance  from  another 
investigator  and  they  are  going  to  tell  you  what  to 
look  for? 

A.        Yes,  sir. 
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Q.        If  you  find  anything  related  to  what  you  have 
been  told  to  look  for,    you're  going  to  document  it. 

Nothing  further . 
THE  COURT :     Redirect . 
MR.   MORROW:     No,    Your  Honor. 
THE  COURT:      Special  Agent  Shaver,   you  are 
temporarily  excused.     You  cannot  talk  with  anyone  other 
than  counsel  while  trial  is  still  going  on. 

Call  your  next  witness. 
MR.   MORROW:     Yes,    Your  Honor.     United  States 
calls  Mr.   Mark  Johnson.      (Inaudible) . 
Whereupon, 

MARK  JOHNSON, 

called  as  a  witness,  having  been  first  duly  sworn  to 
tell  the  truth,  the  whole  truth,  and  nothing  but  the 
truth,   was  examined  and  testified  as  follows: 

EXAMINATION  BY  MR.  MORROW 

BY  MR.  MORROW: 

Q.        You  are  Mark  Johnson,   Army  Computer  Forensic 
Investigative  Unit,   Army  Criminal  (Inaudible) 

A .        I  am . 
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Q.       Mr.    Johnson,   what  is  your  current  position 
with  CCIU? 

A.        Digital  Media  Examiner. 

Q .       And  you  work  for  CCIU  or  you  work  for  the 
Digital  Media  Branch  of  CCIU? 

THE  COURT:      I'm  having  trouble  hearing  you. 
Maybe  speak  a  little  slower. 

THE  WITNESS:     Yes,  ma'am. 
BY  MR.  MORROW: 

Q.       Where  do  you  work? 

A.        I'm   (inaudible)     Question  again. 

Q.        Do  you  work  for  CCIU? 

A.        I  work  for  a  branch,    subunit  of  CCIU. 
Q .        How  long  have  you  been  in  Digital 
(inaudible) ? 

A.  Approximately  June  2006. 
Q.  Are  you  a  special  agent? 
A.        No,  sir. 

Q.        What  is  your  position? 
A.        I'm  a  contract  employee  assigned  to 
(inaudible) . 
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Q.       When  did  you  become  a  contract  employee  for 

CCIU? 

A.        In  June  2006. 

Q.       So  were  you  hired  specifically  to  work  at 
CCIU  for  your  contract? 
A.  Yes. 

Q.       What  does  a  digital  forensic  examiner  do? 

A.        We  are  responsible  for  examination  of  digital 
or  media  tool    (inaudible)   anything  related  to 
computers . 

Q.       What  do  you  mean  by  network  device? 
A.        (Inaudible)    routers,    switches,  communication. 
Q.        Do  you  hold  a  supervisory  position  at  CCIU? 
A.        I  do. 

Q.       What  is  that  position? 
A.        I  (inaudible) 

Q.        How  many  people  do  you  supervise? 
A.        I  currently  have  two  subordinates. 
Q.        Do  you  hold  any  certifications  in  Digital 
(inaudible) ? 

A.        Yes,  sir. 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/4/13  Morning  Session 


18 

Q.        What  are  those? 

A.        Certified  through  the    (Inaudible)   DC3 .  I 
hold  digital    (Inaudible) .  (Inaudible) 

Q .        Do  you  hold  any  other  industry 
certifications? 

A.        I  do. 

Q.        What  certifications  do  you  hold? 
A.        I  am  a  certified  information  systems  security 
professional  also  known  as  CCISP. 

Q.        Can  you  explain  what  is  CCISP? 

A.        Industrial  standard  certification  respect  in 
the  industry  covers  lots  of  domains  related  to 
(Inaudible) . 

Q.       When  did  you  obtain  that  certification? 

MR.   HURLEY:     We'll  stipulate  to  Mr.  Johnson. 
THE  COURT :     Do  you  have  initial  foundation 

questions? 

MR.   MORROW:      I'll  quickly  review,   Your  Honor. 
At  this  time  we'll  offer  Mr.   Johnson  as 
an  expert  in  computer  f orensics . 

MR.   HURLEY:     No  objection. 
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THE  COURT:      So  recognized. 
BY  MR.  MORROW: 

Q.  (Inaudible) 

A.       Mr.   No  special  agent  Frederick. 
Q.  (Inaudible) 
A.  (Inaudible) 

Q.        Prior  to  Special  Agent  Shaver,   who  is  the 
special  agent  in  charge  of? 

A.       Special  agent    (Inaudible) . 

Q.        How  long  did  you  work  with  (inaudible) 

A.        Since  June  of  2006. 

Q.        Typically  now  and  also  in  your  work  with 
Special  Agent  Shaver,   how  do  you  receive  (inaudible) 

A.        Receive  a  forensic  request  in  writing  that 
details  what  is  supposed  to  be  looking  for,  what 
evidence  we  are  to  look  at,   the  type  of  information  we 
are  looking  for,   the  legal  basis  and  other  related 
information . 

Q.        Is  this  request  for  examination,    is  a  formal 
document? 

A.        Yes,  sir. 
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Q.        When  you  receive  request  for  an  examination, 
how  long  does  a  examination  typically  take? 

A.       Anywhere  from  a  day  or  two,   months  or  years. 

Q.       You  said  years? 

A.        Yes,  sir. 

Q.        Why  the  variance? 

A.       We  have  wide  swaths  of  what  we  are  looking 
for,   the  detail  how  much  in— depth  we  need  to  get  into. 
Also  sheer  volume.     We  have  exams  that    (inaudible) . 
Takes  a  lot  of  time.      It's  not  like  you  see  on  TV. 


Q. 

What  is  your  task? 

A. 

We  generate  a  report . 

Q. 

Where  is  that  report  sent? 

A. 

It ' s  reviewed  by  a  number  of  people . 

Q. 

Is  it  a  formal  report,    informal  report? 

A. 

Either  or . 

Q. 

Why  either  or? 

A. 

It  depends  on  the  scope  of  what  was  needed. 

Sometimes  if  it ' s  an  examination,    not  likely  to  be  any 
further  investigative,    it  may  or  —  however  in  this 
situation   (Inaudible) . 
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Q.        You  said  AI? 

A.        That  is  a  CCID  format  of  investigative 
report .     More  of  memo  type  arrangement . 

Q.        In  the  report  generating  process  does  anyone 
review  your  work  for  accuracy? 

A.        Yes,  sir. 

Q.        How  does  that  process  work? 

A.       We  have  a  peer  review  process,  other 
examiners  in  the  office  review  the  report  and  the 
foundation  behind  it,   make  sure  we  covered  everything, 
that  the  findings  are  accurate. 

Q.       When  you  are  assigned  a  piece  of  digital 
media,   do  you  work  on  that  alone? 

A.        Not  always. 

Q .       Can  you  explain  that ,   please . 

A.        In  some  cases  the  work  involves  all  of  us  or 
in  the  case  it  is  a  collaborative  process,    just  like 
your  teams  split  case  when  it's  gets  complicated. 

Q.        So  if  you  are  splitting  up  like  the 
(inaudible)   digital  media  how  does  that  work? 

A.       Same  piece  of  evidence. 
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Q.       You  say  collaborative.     Can  you  explain  that, 
please.     How  is  the  office  set  up? 

A.       We  have  relatively  small  offices.     This  is 
callid  the    (inaudible)   about  the  size  of  a  closet.  We 
actually  sit  right  next  to  each  other. 

MR .   MORROW :      Just  one  moment . 

Mr.    Johnson,    in  your  involvement  in  this 
case  did  you  examine  any  digital  media  associated  with 
the  investigation  in  this  case? 

A.        Yes,  sir. 

Q.       What  did  you  observe? 

A.        Forensic  evidence  from  an  external  hard 
drive . 

Q .       What  did  you  say? 

A.        Forensic  evidence  from  a  MAC  and  Pro  hard 
drive,   external  hard  drive. 
Q.       What  is  that  Pro- 
A.       Apple  product  for  laptop. 

Q.        Let's  start  with  the  external.     What  is  an 
external  drive? 

A.        External  drive  is  external  piece  for  storage 
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media,   all  shapes  and  sizes.      In  this  case  it's  a 
container  that  contained  an  internal  hard  drive 
connected  to  the  computer  with  USB. 

Q .       Did  you  examine  the  actual  external  drive  in 
this  case? 

A.        (Inaudible)   that  was  collected  by  the 
collecting  agent. 

Q.        Is  that  the  (Inaudible)? 
A.        Yes,  sir. 

Q .        To  your  knowledge  where  was  this  item 
collected? 

A .        PFC  Manning ' s . 

Q.       Who  asked  you  to  imagine  an  external  hard 
drive? 

A.        I  don't  recall  specifically  who.  Ultimately 
it  came  from  the  original  case  unit,   Agent  Graham. 

Q.        Let's  talk  about  your  process  of  examining 
the  external  hard  drive.     What  did  you  do  first? 

A.       We  checked  out  the  evidence  from  our  evidence 
lockup.     Brought  it  back  to  our  examination  station. 
We  copied  it  to  our  examination  workstation.      Loaded  it 
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into  and  EnCase  and  validated  the  image  is  hash . 

Q.       Why  do  you  validate  the  image  as  hash? 

A.       Make  sure  the  evidence  file  matches  what  is 
originally  collected.     The  EnCase  will  copy  the  hash 
during  my  examination,    come  up  with  a  mathematical 
value  and  compare  that  with  the  value  that ' s  embedded 
in  the  file  itself.     We  also  compare  that  with  evidence 
collection  documentation. 

Q.        Were  there  any  verification  issues  with  the 
hash  value  for  the  external  hard  drive  that  you 
examined? 

A.        No,  sir. 

Q .       And  during  your  examination  of  the  external 
hard  drive  did  you  find  anything  of  interest  in  this 
investigation? 

A.       We  did.     There  were  three  pieces  of 
information  that  we  found  that  might  be  related. 

Q.       And  what  were  those  pieces  of  information? 

A.        Text  file.     We  found  a  PowerPoint 
presentation  and  video . 

Q.       Was  the  text  file  located  on  the  external 
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hard  drive? 

A.        It  was  stored  in    (Inaudible) . 

Q.        When  you  reviewed  the  information  in  EnCase, 
were  you  able  to  determine  when  the  file  was  created? 
A.  Yes. 

Q.       And  how  did  you  determine  when  the  file  was 
created? 

A.        The  file  system  contains  operation  date 
sometimes . 

Q.       When  is  that  (inaudible)? 

A.       Data  about  data.      In  this  case  the 
information  about  the  file  itself. 

Q.        How  does  EnCase  show  you  that  data 
essentially?     Explain  that,  please. 

A.        EnCase  in  this  situation  will  show  it  to  me 
in  a  spreadsheet  like  format . 

Q.       Do  you  recall  when  this  text  file  was 
created? 

A.        To  my  recollection  it  was  29  November  of 
2000  —    (Inaudible) . 

Q.        When  you  found  this  text  file,    did  you  review 
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the  contents  of  the  text  file? 
A.        I  did. 

Q .        I'm  retrieving  what  has  been  marked  as 
Prosecution  Exhibit  24  for  identification. 

I'm  handing  the  witness  what  has  been 
marked  as  Prosecution  Exhibit  24  for  identification. 
Mr.    Johnson,    do  you  recognize  this  document? 

A.        I  do. 

Q.       And  what  is  it? 

A.        This  is  the  contents  of  a  text  file 
( inaudible . ) 

Q.       Does  this  document  accurately  depict  the  text 
file  you  found  on  the  external  hard  disk  drive? 
A.        It  does. 

Q.        If  you  printed  this  text  file  as  you  found 
it,    is  this  how  it  would  appear? 
A.  Yes. 

Q.        Where  was  this  file  found? 
A.        In  the  allocated  (inaudible) 

Q.       Move  to  admit  Exhibit  24  for  identification 
as  evidence . 
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(Pause) 

BY  MR.  MORROW: 

Q.       Mr.    Johnson,    you  say  you  also  found  a 
PowerPoint  ? 

A.  Yes. 

Q.        Where  was  this  PowerPoint? 

A.       Allocated  file  system. 

Q.       Do  you  recall  the  name  of  the  file? 

A.        Not  specifically.      I  do  know  it  was 
(inaudible) . 

Q.       So  it ' s  like  the  free  (inaudible) 

Your  Honor,    I'm  retrieving  what  would  be 
Prosecution  Exhibit  25  for  identification.      I'm  handing 
the  witness  what  would  be  Prosecution  Exhibit  25  for 
identification . 

I'm  handing  the  witness  what  would  be 
marked  as  25  for  identification.  Retrieving 
Prosecution  Exhibit  24 . 

Mr.    Johnson,    do  you  recognize  this 

document  ? 

A.        I  do. 
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Q.        What  is  it? 

A.        It  is  the  PowerPoint  that's  been  opened. 
Q.        (Inaudible)    Open  Office  Presentation? 
A.        Open  Office  is  the  version  that  would  be 
PowerPoint  clone . 

Q .        It  is  a  representation  referring  to  printed 

form? 

A.        Yes,  sir. 

Q .        I'm  retrieving  what  would  be  marked  as 
Prosecution  Exhibit  25  for  identification. 

No  further  questions,    Your  Honor. 
EXAMINATION  BY  MR.  HURLEY 

BY  MR.  HURLEY: 

Q .  Good  morning . 
A.        Good  morning. 

Q.       In  the  investigative  process,   the  process  of 
taking  forensic  images,   and  what  you  do  with  those, 
fair  to  say,   you  take  a  forensic  image  and  you  perform 
your  investigation? 

A.  Yes. 

Q.        When  you  are  doing  your  investigation,  you 
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are  going  to  have  things  that  you  are  looking  for? 
A.        Yes,  sir. 

Q.       And  when  you're  talking  about  a  computer  or  a 
hard  drive,   there  is  a  lot  of  different  types  of 
information  that  you  can  have  on  that  particular  media? 


A. 

Yes,  sir. 

Q. 

Emails? 

A. 

Yes  . 

Q. 

PowerPoint  presentations? 

A. 

Yes  . 

Q. 

Text  files? 

A. 

Yes,  sir. 

Q. 

All  potentially  valuable.     They  belong  to,  in 

all  likelihood,    the  person  who  owns  that  particular 
media? 

A.        Yes,  sir. 

Q.        In  this  particular  case  you  were  looking  at 
all  those,   you  looked  at  everything  on  this  particular 
hard  drive? 

A.        Yes,  sir. 

Q.       And  by  this  hard  drive,    I'm  talking  about  the 
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external  hard  drive? 
A.        Yes,  sir. 

Q.       With  respect  to  this  case  there  were 
particular  things  you  were  looking  for.     You  were 
looking  for  anything  that  implicated  WikiLeaks;    is  that 
correct? 

A.        That  is  correct. 

Q.       You  found,   as  you  talked  about  on  direct,  you 
found  some  contact  information? 
A.        Yes,  sir. 

Q.        You  didn't  find  anything  else  on  that  hard 
drive  that  implicated  WikiLeaks? 
A.        I  don't  recall,  sir. 

Q.       Would  you  have  mentioned  that  in  your  report? 
A.        Yes,  sir. 

Q.        You  would  have  also  been  looking  for  anything 
that  would  have  expressed  a  hatred  of  America  on  that 
hard  drive? 

A.        It  would  have  been  noted. 

Q.       You  would  have  looked  at  everything  on  the 
hard  drive? 
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A.  Yes. 

Q.        If  you  would  have  seen  that,   you  certainly 
would  have  noted  that? 
A.        Yes,  sir. 

Q.        You  didn't  note  that  on  your  report? 
A.        No,  sir. 

Q.        Because  you  didn't  find  it? 
A .        Right . 

Q.       You  also  would  have  noted,    if  you  had  found 
anything  that  related  to  terrorism? 
A.        Yes,  sir. 

Q.        If  there  was  any  sort  of  evidence  that 
suggested  that  my  client  was  supporting  terrorism,  you 
would  have  noted  that? 

A.        Yes,  sir. 

Q .        You  didn ' t  note  anything? 
A.        I  did  not  discover  anything,    no,  sir. 
Q.        You  also  would  have  made  note  of  anything 
that  would  have  shown  a  transfer  of  funds? 

A.        If  I  had  discovered  anything,  yes. 

Q.        If  you  had  found  something  that  seemed  like  a 
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lot  of  money  for  a  PFC  to  have,   you  would  have  noted 
that? 

A.  Yes. 

Q.        You  didn't  note  that  in  this  case? 
A.        That  is  correct. 

Q.       And  going  back  to  —  actually,   no  further 
questions,    Your  Honor. 

THE  COURT:  Redirect? 

MR.   MORROW:     No,    Your  Honor. 

THE  COURT:     Mr.    Johnson,   you  are  temporarily 

excused . 

MR.   MORROW:     United  States  requests  a 
ten-minute  recess. 

THE  COURT:     Alright.     Any  objection. 
MR.   HURLEY:     No  objection,    Your  Honor. 
(Brief  Recess) 

THE  COURT:     Please  be  seated.     Ready  to 

proceed? 

MR.   FEIN:      Toni  Edwards.      Stipulation  with 
respect  to  testimony  of  Special  Agent  Toni  Edwards,  3 
January  2013.     Prosecution  Exhibit  26.     Hereby  agreed 
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defense  counsel,  trial  counsel  that  if  Special  Agent 
Edwards  were  present  to  testify  during  the  merits  of 
the  court  martial,  he  would  testify  substantially  to 
the  following : 

Since  March  of  2012,    I  have  been 
employed  as  special  agent,   Homeland  Security 
Investigations,    Department  of  Homeland  Investigation 
Atlanta  Field  Office,   empowered  by  law  to  investigate 
requests  for  unlawful    (inaudible)   of  goods  and 
technology  to  destinations  outside  the  United  States. 

Prior  to  working  for  HSI  from  March  2008 
to  March  2012,    I  was  employed  as  Special  Agent  with  the 
(inaudible)    criminal  investigation  U.S.A.   CI  Computer 
Crime  Investigative  Unit,    CCIU,    at  Ft.  Belvoir, 
Virginia . 

In  this  capacity  I  was  responsible  for 
the  investigation  of  violations  pertaining  to  computer 
intrusions  and  to  other  types  of  malicious  computer 
activity  directed  against  the  United  States  Army,  18 
U.S.C  1030. 

Situational  awareness  U.S.A.  CIDC 
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Special  Agent  I  was  to  investigate  crimes,  all 
violations  of  the  Uniform  Code  of  Military  Justice  and 
other  comparable  Federal  and  State  Laws  where  there  is 
United  States  Army  or  Department  of  Defense  interest . 

I  have  participated  and  conducted 
investigations  of  violations  of  United  States  Laws  and 
regulations  pertaining  to  computer  intrusions  and 
participated  in  the  execution  of  search  warrants  and 
individuals  and  companies . 

Before  working  at  U.S.A.   CCIU  from 
November  2007  to  November  2008,    I  was  employed  as 
Special  Agent  with  the  Bureau  of  Industry  and  Security 
Office  of    (inaudible)    Enforcement.     And  from  May  2003 
to  October  2006,    I  was  a  deputy  prosecutor  for  Morgan 
County,  Indiana. 

From  August  2000  to  August  2005,  I 
served  in  the    (inaudible)    county,    Indiana  deputy 
sheriff's  department  as  deputy  sheriff  where  I  received 
training  in  evidence  collection. 

Further,    I  am  a  graduate  of  Federal  Law 
Enforcement  Training  Center,    Criminal  Investigator 
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Training  Program  where  I  also  received  training  in 
evidence  collection. 

In  addition  to  being  employed  as  Special 
Agent,    I  currently  serve  inactive  ready  reserve  as 
Judge  Advocate  in  the  national  District  of  Columbia. 
In  2003  I  received  a  juris  doctorate  from  Indiana 
University  and  was  subsequently  admitted  to  the  Indiana 
Bar . 

Bachelors  of  arts  in  psychology  from  the 
University  of  North  Florida  and  Doctorate  Juris 
Prudence  from  Indiana  University,    School  of  law. 
Currently  licensed  to  practice  law  in  Indiana. 

My  experience   (inaudible)   as  a  state  law 
enforcement  officer,    state  prosecutor  and  Special  Agent 
has  included  investigation  of  cases  involving  violent 
and  non— violent  crimes,   as  well  as  the  use  of 
computers . 

I  have  also  received  training  and  gained 
experience  in  interviewing  and  interrogation  techniques 
(inaudible)   crime  scene  examination  evidence 
collection,    search  warrant  applications  and  execution 
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of  searches  and  seizures  and  other  criminal  laws  and 
procedures . 

Further,    I  have  completed  the  Department 
of  Defense  Cyber  courses,    introduction  to  computer 
hardware,    computer  incident  response  course  and  Windows 
forensic  examination  EnCase . 

Together  this  afforded  me  certification 
as  Department  of  Defense  Certified  Digital  Media 
Collector  and  (inaudible) 

(Inaudible) .      I  review  the  custody  of 
document  and  also  ensure  the  description  of  evidence. 
I  check,    for  example,    recorded  serial  numbers  markings 
for  identification  and  check  the  description  match  the 
associated  evidence . 

I  ensure  the  proper  information  such  as 
date  and  time  are  properly  and  accurately  recorded.  I 
maintain  secure  custody  of  the  evidence  prior  to 
transferring  to  another  evidence. 

In  this  particular  investigation  I 
assisted  with  witness  interviews  and  handling  of 
evidence .      In  so  doing  I  worked  with  Special  Agent 
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Charles  Clapper  and  Gary  Young . 

On  12  June  2010,    I  received  several 
pieces  of  electronic  evidence  relating  to  this 
investigation  from  the  hand  of  Mr.   Adrian  Lamo  and  with 
his  consent.     On  12  June  2010,   Agent  Adrian  Lamo 
(inaudible)   also  gave  contained  law  enforcement 
personnel  on  two  separate  CID  forms    (inaudible)  To 
serve  electronic  devices  for  all  information  in  any 
form  pertaining  to  communications  which  may  be  in  the 
form  of  emails,    instant  message,    chats,   documents,  data 
computer  code  or  log  files,   drawings,   photographs  or 
any  other  data,    encrypted  plain  text  or  any  other 
format  relating  to  PFC  Manning  and/or  the  disclosure 
classified  information  which  is  the  property  of  United 
States  Government . 

The  first  piece  of  evidence  collected 
and  further  handled  was  Lenovo  laptop  computer  with 
computer  hard  drive    (inaudible)    or  DA  Form  4137  marked 
as  document  number  DN7  6— 10  and  known  as  Lamo  hard 
drive.      It  was  collected  from  Mr.   Lamo  in  Sacramento, 
California  on  12-June  2010. 
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The  second  piece  of  evidence  collected 
and  further  handled  was  HP  mini— brand  computer .  Serial 
number  CNU90513VK  with  a  CD  computer  hard  drive,  hard 
drive  Serial  Number    (inaudible)    recorded  as  Item  1  on 
DA  Form  3137  marked  as  document  number  DN77— 10  and 
known  as  Lamo  HP  hard  drive .      It  was  collected  from 
(inaudible)    Sacramento,    California,    12  June  2010. 

Using  the  DA  form  I  released  these 
pieces  of  evidence  to  Special  Agent  Clapper.     On  14 
June,    I  properly  regained  possession  from  Special  Agent 
Clapper  before  properly  leaving  them  to  the  evidence 
custodian  Mr.   Gary  Young  on  15  June  2010,   which  is 
documented  on  a  DA  Form  4137. 

While  in  possession  of  these  items  I 
maintained  control  over  them,    stored  them  properly  and 
allowed  no  one  else  to  access  them  and  did  not  alter 
the  evidence  in  any  way . 

I  have  no  reason  to  believe  this 
evidence  was  damaged  or  contaminated  in  any  way .  After 
releasing  the  evidence  to  Gary  Young    (inaudible)  my 
knowledge  Ii  had  no  further  action  with  the  evidence. 
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Prosecution  Exhibit  13  for 
identification  is  a  Lamo  Fujitsu  hard  drive,    Item  1  of 
DN7  6— 10  Prosecution  Exhibit  14  for  identification  Lamo 
HP  Fujitsu  hard  drive  Item  DN7710 . 

United  States  calls  Agent  Lamo . 

Whereupon, 

ADRIAN  LAMO, 

called  as  a  witness,  having  been  first  duly  sworn  to 
tell  the  truth,  the  whole  truth,  and  nothing  but  the 
truth,   was  examined  and  testified  as  follows: 

EXAMINATION  BY  MR.  FEIN 

BY  MR.  FEIN: 

Q.        You  are  Mr.   Lamo  previously  from  the 
Sacramento  area  of  California? 

A.        Yes,    I  am. 

Q.        Thank  you,    sir.     Mr.   Lamo,    how  do  you  know 
PFC  Manning? 

A.        From  a  series  of  conversations  we  had  online 
in  2010. 

Q.        When  did  you  first  interact  with  PFC  Manning? 
A.        On  or  about  May  20th  of  2010. 
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Q.       And  what  was  the  form  of  that  interaction? 
A.        In  a  two— way  encrypted  email  from  PFC  Bradley 
Manning . 

Q.        How  did  you  know  that  email  was  from  PFC 
Bradley  Manning? 

A.        Based  on  retrieving  return  address  common  to 
all  email . 

Q.       What  do  you  mean  by  return  address 
information? 

A.        Information  indicating  where  it  originated 
from  which  allowed  the  recipient  to  reply. 

Q.        Is  that  an  email  address? 

A.  Yes. 

Q.       What  was  the  email  address? 
A .        Bradley . e . manning@gmail . com,  military 
network . 

Q.        So  you  received  multiple  emails  from  PFC 
Manning? 

A.        Yes,    I  did. 

Q.        So  the  first  one  he  said 
bradley.e.manning@gmail.com.      Can  you  explain  to  the 
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Court  what  the  second  email  you  received,   what  the  name 
was  on  the  email? 

A.        I'm  sorry.     Which  one  are  you  referencing? 

Q.        The  second  one.      The  one  you  just  mentioned, 
army  email  address? 

A.        Yes.     A  string  of  letters  numbers  that 
identified   (Inaudible) . 

Q.        Did  it  have  a  name  as  beginning  user  name? 

A.        Yes.     His  name  was  presented  as  user  name. 

Q.       What  happened  after  you  received  the  initial 
email? 

A.       After  the  initial  one  I  disregarded  the 
email .     After  receiving  several  more  I  wrote  back 
suggesting  that  the  user  should  perhaps  contact  me  via 
AOL  messenger  to  have  a  Xchat . 

Q.       Was  this  email  encrypted  or  not? 

A.        The  one  which  I  sent  reply  was  not,    to  the 
best  of  my  recollection. 

Q.       Was  the  email  that  was  sent  to  you  encrypted? 

A.        Yes,    it  was. 

Q.       Would  you  explain  to  the  Court  what  that 
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means? 

A.        Encryption  encodes  an  email  to  a  particular 
user  rather  to  a  user  site  affiliate  recipient  is 
supposed  to  be  able  to  read  it . 

Q.        What  is  a  cypher? 

A.        In  this  case  public  key  cypher. 

Q.       What  do  you  mean  by  public  key? 

A.        Series  of  codes  which  instruct  the  computer 
how  to  encrypt  the  message  in  such  a  way  that  the 
recipient  will  decrypt  it . 

Q.       Were  you  able  to  read  the  initial  email  from 
PFC  Manning? 

A .        I  was  not . 

Q.       Why  not? 

A.        He  had  specified  an  incorrect  cipher,  one 
which  I  formerly  used  but  had  fallen  out  of  use. 

Q.        How  does  one  find  this  cypher,   this  code? 

A.       There  are  a  couple  of  trailers  called 
(inaudible)    servers  which  contain  collections  of  keys 
so  users  can  find  themselves  more  easily. 

Q.       And  when  did  you  then  realize  when  you 
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started  chatting  this  was  PFC  Manning? 

A.        There  was  a  particular  point  in  our 
interactions  where  PFC  Manning  mentioned  his  name  was 
Brad  and  I  replied,   oh,    I'm  an  idiot.     You  are  that  guy 
from  the  emails . 

Q .       And  how  did  you  chat  with  PFC  Manning? 

A.       By  a  service  message  —  it  was  online  called 
messenger  and  through  a  free  third  party  program. 

Q.       So  what  program  did  you  use? 

A.        P-I-D-G-I-N . 

Q.       Could  you  explain  briefly  —  so  the  network 
is  being,   you  used  message  online  instant  messaging? 
A.  Yes. 

Q.        You  did  not  online  instant  message 
programming? 

A.        No.      There  were  numerous  chat  lines  that 
support  the  service  but  are  not  made  (inaudible) 

Q.       Were  these  chats  encrypted? 

A.        Yes,   they  were. 

Q.        What  does  that  mean? 

A.        That  to  a  third  party  intercepting  them  on 
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(inaudible)   this  would  be  unreadable,   the  intended 
party  wouldn't  be  able  to  receive  them. 

Q.       Mr.   Lamo,    (inaudible) .     What  is  your 
experience  with  computers  networks? 

A.        I  have  extensive  experience  (inaudible) 
testing  that  is  security  of  computer  networks 
conducting  review  of  related  to  security.     And  finding 
ways  to  bypass  and  improve  security. 

Q .       And  how  many  years  of  experience  in  this 
field  have  you  worked? 

A.  15. 

Q.        In  those  15  years  have  you  been  arrested? 
A.        Yes,    I  have. 

Q .       Based  on  that  have  you  been  arrested  based  on 
activities  related  to  that  field? 
A.        Yes,    I  have. 
Q.       And  what  for? 

A.        For  unlawful  access  to  computer  networks  at 
the  New  York  Times  Company,   Microsoft  and  Lexis— Nexis . 
Q.        When  did  this  occur? 

A.        The  first  conduct  took  place  in  2002.  The 
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arrest  took  place  in  2003  and  the  conviction  in  2004. 


Q 
A 

Q 

guilty 
A 
Q 


So  you  were  convicted? 
Yes,    I  was.      I  pled  guilty. 

Did  you  confess  to  those  crimes  when  you  pled 


Yes,    I  did. 

Going  back,   Mr.   Lamo,   when  did  you  first 
start  chatting  with  PFC  Manning? 

A.        On  or  about  May  20th,  2010. 

Q.       How  did  you  know  once  the  chat  started  that 
it  was,    in  fact,    PFC  Bradley  Manning? 

A.        During  the  course  of  the  chats  I  stated  to 
the  user,   perhaps  we  could  connect  on  Facebook.  Once 
we  did  connect  on  Facebook,   a  social  networking  site 
with    (inaudible)    information,    one  another  I  ascertained 
that  the  name  of  the  user  was  the  same  name  as  the 
sender  of  the  emails  which  I  previously  received. 

Q.        Is  this  something  you  do  for  most  individuals 
that  you  chat  with? 

A.        Yes.     Facebook  is  a  very  popular  social 
network  which  many  people  connect . 
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Q.       And  what  were  your  conclusions  based  off  of 
your  analysis  of  Facebook  and  comparing  that  to  the 
chats? 

A.        Based  on  the  user  description  of  themselves, 
both  in  the  chats  and  on  Facebook,   as  well  as  return 
email  address,    I  ascertained  that  I  was  talking  to 
somebody  who    (inaudible)    Brad  Manning,   who  was 
associated  with  the  military  network   (inaudible)  same 
user . 

Q .        What  was  the  moniker  the  user  name  used  in 
chat  between  you  and  PFC  Manning? 

A.        I'm  sorry.     Mine  or  his? 
Q .        Both . 

A.       Mine  was    (inaudible)    on  AOL,    (inaudible) . 
The  defendant's  was  bradass87. 

Q.        Did  you  only  use  the  Pidgin  program  to  chat 
for  online? 

A.        That  is  correct. 

Q.        To  chat  using  Pidgin    (inaudible)    the  program? 

A.        I  used  two  different  computers. 

Q.        How  many  computers  at  the  time  did  you  have 
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access  to? 

A.       More  than  two,    fewer  than  five. 

Q.       Did  you  only  use  these  two  computers  that  you 
are  referencing  to  chat  with  PFC  Manning? 

A.  Yes. 

Q.        What  were  those  two  computers? 

A.        One  was  a  Lenovo  Think  Pad.      The  other  was  an 
HP  mini- 

Q.        Lenovo  Think  Pad,    is  that  desktop,  laptop? 

A.        It  is  a  laptop  made  by  the  successor  IBM 
(inaudible) . 

Q.        HP,    describe  that  for  the  Court? 

A.        It  was  the  netbook,    small,    Low  powered, 
mostly  used  online  activity. 

Q.       Where  did  you  conduct  these  chats? 

A.        In  the  state  of  various  —  at  my  residence, 
at  Starbucks  and  at  a  different  Starbucks,  Safeway 
offering  access.      Internet  cafe's  and  at  home. 

Q.       Did  you  record  these  chats? 

A.        Yes,    I  did. 

Q.        Was  it  your  normal  practice  to  record  the 
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chats? 

A.       At  that  time  and  possibly  still  by  default 
recorded  all  chats.     So,  yes. 

Q.       So  did  you  activate,    I  guess,   Pidgin,   did  you 
affirmatively  tell  Pidgin  to  record  those  chats? 

A.        No.      It's  not  evident  to  user  that  feature  is 
enabled.      I  would  have  to  disable  it. 

Q.        You  had  not  done  that? 

A .        I  had  not . 

Q.       You  recorded  all  chats  with  all  people? 
A.        Yes,    I  did. 

Q.       Did  anyone  else  have  access  to  these 
computers  at  the  time  you  were  chatting? 

A.        No.     Access  is  prevented  by  various 
countermeasures . 

Q.       What  do  you  mean  by  that? 

A.        Encryption,   password  and  physical 
inaccessibility . 

Q.        Let's  start  with  physical  inaccessibility. 
How  were  they  not  physically  accessible  to  anyone  else? 

A.        In  that  they  were  generally  on  my  person. 
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When  I  went  out,    I  went  out  usually  with  one  I  would 
talk  with. 

Q.        When  did  the  chats  first  start? 

A.        On  or  about  May  20th  of  2010. 

Q .        When  did  they  end? 

A.        On  or  about  May  26th  of  2010. 

Q.        You  kept  them  on  your  person  between  those 

days? 

A.       Computer  geeks  do  not  always  leave  the  house 

much . 

Q.        Did  you  keep  them  on  yourself? 
A.        Yes,    I  did. 

Q.       When  you  went  to  Starbucks,   you  had  both 
computers? 

A.        No.     As  I  say,    I  travel  with  one  to  Starbucks 
and   (inaudible) . 

Q .       And  then  what  prevented  someone  in  your 
quarters,    or  if  you  were  at  Starbucks,    from  accessing 
the  actual  information  on  the  computer? 

A.        They  would  require  a  password  in  order  to 
access  the  computer.     Then  a  pass  phrase  as  well  in 
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order  to  decrypt  the  drive . 

Q.        How  many  people  know  that  password  or  pass 
phrase? 

A.       At  the  time  only  myself. 
Q.        You  didn't  share  that  with  anyone? 
A.        No.      I  was  the  only  authorized  user  and  the 
only  one  capable  of  accessing  that  computer. 
Q.  (Inaudible) 

A.        (inaudible)    June  12  of  2010. 
Q .       Who  did  you  meet  with? 
A.        Special  Agent  Toni  Edwards. 
Q.        Did  Special  Agent  Edwards  collect  any 
evidence  from  you? 

A.        Yes,   he  did. 

Q.       What  did  he  collect;   what  computer? 

A.        He  collected  a  hard  drive  from  the  Lenovo 
Think  Pad  and  the  HP  mini  in  its  entirety. 

Q.  At  the  time  he  collected  those  were  both  the 
hard  drives  that  you  just  spoke  about  both  in  working, 
proper  working  condition  at  the  time? 

A.        Yes,   they  were. 
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Q.       Did  you  ever  copy,   make  copies  of  those  chat 
logs  between  the  time  of  the  chats  and  giving  those 
computers  and  computer  and  hard  drive  to  him? 

A.        Yes,    I  did. 

Q.       Did  you  ever  manipulate,   change,  alter, 
delete,   edit  the  original  logs  that  were  on  your 
computers? 

A.        The  original  logs  as  preserved  by  Pidgin  were 
no  way  edited  or  redacted. 

Q.        You  did  alter  other  versions  of  the  logs? 

A.        Yes.     Ones  which  I  shared. 

Q.       What  do  you  mean  by  "shared"? 

A.       With  people  in  the  investigation. 

Q.       You  shared  these  logs  at  some  point? 

A.  Yes. 

Q.       What  people  did  you  share  the  logs  with? 
A.        Kevin  Poulsen  and  Ellen  Kakashima 
Q.        Those    (inaudible)    copies  of  the  originals  or 
alter  copies? 

A.       They  were  copied  with  retained  redactions. 
Q.        You  did  not  alter  the  originals? 
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A.        I  did  not . 

Q.        How  do  you  know  that  you  did  not  alter  the 
originals? 

A.       At  no  time  did  I  save  them  or  even  open  them 
in  any  way  capable  of  saving  them. 

Q.       When  you  surrendered  digital  media  to  Special 
Agent  Edwards,   did  you  sign  over  that  evidence  on 
custody  form? 

A.        Yes,    I  did. 

Q.        Did  you  sign  that  form? 

A.  Yes. 

Q.        Did  you  give  Special  Agent  Edwards  any  other 
laptops  or  computer  hard  drives? 

A.        I  gave  Special  Agent  Edwards  only  the  hard 
drive  from  the  Lenovo  and  the  HP  Mini . 

Q.        Now,   Mr.   Lamo,    have  you  ever  been  diagnosed 
with  mental  health  conditions? 

A.        Yes,    I  have. 

Q.       And  what  are  those? 

A.       Asperger  Syndrome,    autism,   major  depression 
and  generalized  anxiety. 
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Q.       Do  those  conditions  generally  affect  your 
memory? 

A.        No,    they  do  not.     And  they  are  not  known  to. 
Q.       Do  you  take  prescribed  medications  to  assist 
you  with  living  with  those  conditions? 
A.        Yes,    I  do. 

Q.       Have  those  medications  ever  affected  your 
memory? 

A.       They  have,  yes. 

Q.       Have  you  ever  used  those  medications  in  a 
manner  that  could  affect  your  memory? 
A.  Yes. 

Q.       And  would  your  chatting  with  PFC  Manning  in 
2010,   were  you  using  those  medications  in  a  way  that 
affected  your  memory? 

A .        I  was  not . 

Q.        Between  the  time  of  your  chats  in  May  2010, 
and  turning  over  the  hard  drive  and  laptop  to  Special 
Agent  Edwards  in  2010,   were  you  using  those  medications 
that  in  any  way  affected  your  memory? 

A .        I  was  not . 
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Q.       And  today,   Mr.   Lamo,    in  this  court  martial 
and  this  testimony,    are  you  suffering  from  any  memory 
loss  either  from  your  diagnosed  medical  condition  or 
medication  use? 

A.  No. 

MR.  FEIN:  No  further  questions,  Your  Honor. 
THE  COURT:  Defense. 

EXAMINATION  BY  MR.  COOMBS 

BY  MR.  COOMBS: 

Q.       Mr.   Lamo,    in  early  2000,   you  committed  a 
string  of  attacks  against  several  large  companies, 
correct? 

A.       A  string  of  offenses,  yes. 

Q.        In  2004,    you  pled  guilty  to  computer  fraud? 
A.        Yes,    I  did. 

Q.        You  received  a  six  month  sentence,  house 
arrest,   two  years  probation? 
A.        That's  correct. 

Q.       You  were  22  years  old  at  the  time  that  you 
pled  guilty? 

A.        I  was. 
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Q .        Same  age  that  PFC  Manning  was  when  he  started 
the  IM  chat  with  you? 

A.        That  is  also  correct. 

Q.       As  you  said,   your  IM  chats  began  on  or  about 
the  20th  of  May  2010? 
A.  Yes. 

Q.       And  you  chatted  until  on  or  about  the  26th  of 
May  2010? 

A.        That  is  also  correct. 

Q.        Now  the  day  after  your  initial  chat  with  PFC 
Manning  you  contacted  law  enforcement? 

A.        That's  correct.     Well,  (inaudible). 
Q.        Law  enforcement? 
A.  Yes. 

Q.       And  you  contacted  law  enforcement  because  you 
were  concerned  about  the  type  of  information  that  PFC 
Manning  had  shared  with  you? 

A.  Yes. 

Q.        You  were  also  concerned  for  PFC  Manning's 

life? 

A.  Yes. 
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Q.       And  after  contacting  law  enforcement  you 
continued  to  chat  with  PFC  Manning? 
A.        That  is  correct. 

Q.       And  based  on  your  conversations  you 
determined  that  PFC  Manning  was  young? 
A.  Yes. 

Q.       You  believed  he  was  ideologically  motivated? 

A.        That  was  my  speculation,  yes. 

Q.        You  also  saw  him  as  well  intentioned? 

A.        From  his  point  of  view,  yes. 

Q .        From  your  point  of  view  you  saw  him  as  well 
intentioned? 

A.       Subjectively,  yes. 

Q.       You  also  saw  him  as  idealistic? 

A.        Yes,    I  did. 

Q.        Now  you  testified  on  direct  that  PFC  Manning 
identified  himself  in  the  chat  conversations. 
A.  Correct. 

Q.       And  you  testified  on  direct  that  he  said 
Bradley  Manning? 
A.  Yes. 
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Q.        Now  he  told  you  during  your  conversation  that 
he  wanted  to  disclose  this  information  for  public  good? 

A.        That  was  an  interpretation,  yes. 

Q.        Based  on  your  conversation  you  saw  something 
very  familiar  about  that? 

A.  Yes. 

Q.        You  saw  a  young  22  year  old  with  good 
intentions,   much  like  you  were? 
A.        That  was  correct. 

Q.        You  did  not  know  PFC  Manning,  correct? 
A.        Not  personally,  no. 

Q.        The  two  of  your  never  met  in  person? 
A.  No. 

Q.        PFC  Manning  told  you? 

MR.   FEIN:     Objection,  hearsay. 

MR.   COOMBS:      It's  not  offered  for  the  truth. 
To  explain  the  conduct  at  this  point .      I  can  ask  the 
question.      I'll  caution  the  witness  not  to  answer 
before  the  objection  and  we'll  see  what  my  question  is. 

THE  COURT:      Can  you    (inaudible)    to  ask  the 
question    (inaudible)    research  on  you  and  the  issue. 
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MR.   COOMBS:      I'm  not  offering  it  for  the 
truth.      (inaudible)    just  to  explain  the  nature  of  this 
individual ' s  response . 

THE  COURT:      The  initial  question  wasn't  that 
question.     You  can  ask  that  question. 

MR.   COOMBS:      That  was  my  question.  PFC 
Manning  told  you  he  had  done  some  background 
information  on  you .     PFC  Manning  told  you  and  then  I 
got  the  objection. 

THE  COURT :      Is  that  the  question  you  objected 

to? 

MR.   FEIN:     Yes.      That  PFC  Bradley  Manning 

told  — 

THE  COURT:      I'm  concerned  about  getting  the 
hearsay.  (Inaudible) 
BY  MR.  COOMBS: 

Q.        In  this  instance  were  you  made  aware  that  PFC 
Manning  knew  facts  about  you? 

A.  Yes. 

Q.       And,    in  fact,   you  were  a  supporter  of  LBGT, 
correct? 
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A.  Yes. 

Q.        LBGT  is  Lesbian,    Gay,    Transgender  Community? 
A.  Yes. 

Q.       And  in  1998,    you  were  appointed  to  the  LBGT 
(inaudible)   task  force  on  the  (inaudible) 
A.        That  is  correct. 

Q.       You  also  became  a  volunteer  for  gay  and 
(inaudible) 

A.  Yes. 

Q .        PFC  Manning  knew  that  you  were  a  threat 
analyst  and  Gray  Hacker.      Is  that  correct? 

MR.   FEIN:     Objection.  Speculation. 
MR.   COOMBS:  (inaudible) 

MR.   FEIN:      It's  hearsay  based  on  what  PFC 
Manning  did  or  didn't  tell  him. 

THE  COURT :      It  is  hearsay . 

MR.   COOMBS:      (Inaudible)    for  the  conversation 
not  for  the  truth  of  the  matter.      To  explain  why  PFC 
Manning  reached  out  to  him  and  the  nature  of  that 
conversation . 

THE  COURT:     Alright.      (Inaudible)    The  trial 
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is  before  me.      It's  hearsay.      I'll  disregard  it.  Go 
ahead . 

BY  MR.  COOMBS: 

Q .       So  you  knew  that  he  was  aware  that  you  were 
in  Gray  Hat  Hacker,  correct? 

A.  Yes. 

Q.       And  what  is  a  threat  analyst? 

A.       Analyst  who  involves    (inaudible)    threats  and 
international  threats  they  are    (inaudible)   or  more. 

Q.        What  is  a  Gray  Hat  Hacker? 

A.       A  hacker  is  colloquially  someone  who 
performs,    not  always  with  permission,   not  for  military 
purposes . 

Q.        You  also  were  aware  that  PFC  Manning  knew 
that  you  had  donated  to  WikiLeaks? 

A.        I  recall  that  he  referenced  that  he  was  aware 
because  I  mentioned  WikiLeaks  in  connection  with  that . 
I  don't  know  whether  he  knew  I  donated. 

Q.        Essentially  that  was  kind  of  why  PFC  Manning 
was  reaching  out  to  you? 

A.        That  was  one  reason,  yes. 
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Q.        Now  I  want  to  ask  you  some  specific  questions 
about  your  conversation  with  PFC  Manning,  okay? 
A.  Yes. 

Q.        Your  conversation  began  with  PFC  Manning,  of 
course,    reaching  out  to  you  to  make  contact;    is  that 
right? 

A.  Yes. 

Q.       And  he  told  you  he  was  an  intelligence 
analyst? 

THE  COURT:     Again,   what  is  the  basis  for 

this? 

MR.   COOMBS:      In  this  instance  probably  for 
remainder  of  my  questions  the  response    (Inaudible) . 

THE  COURT:      That  exception  (inaudible) 

proceed . 

MR.   COOMBS:      (Inaudible)   the  declarant  in 
this  case,   the  individual  to  testify  about  declarant 
statement  then . 

THE  COURT:     Existing  statement. 

MR.   COOMBS:      So  that's  what  I'm  going  after. 

THE  COURT:      Government,   what  is  your 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/4/13  Morning  Session 

62 

position? 

MR.   FEIN:      Can  I  have  a  moment,    Your  Honor. 
State  of  mind  but    (inaudible)   answer  was  for  the  entire 
line  of  questioning. 
BY  MR.  COOMBS: 

Q.       He  told  you  he  was  an  intelligence  analyst? 

A.  Yes. 

Q.       He  said  to  you,   he  thought  he  would  reach  out 
to  somebody  like  you  who  would  possibly  understand? 
A.  Yes. 

Q.  During  this  initial  chat  conversation  he  told 
you  about  his  life  and  his  upbringing? 

A.        In  some  amount  of  detail,  yes. 

Q .       He  told  you  that  he  was  being  challenged  due 
to  a  gender  identity  issue? 

A.  Yes. 

Q.  He  also  told  you  that  he  had  been  questioning 
his  gender  for  years,  but  started  to  come  to  terms  with 
that  with  his  gender  during  the  deployment? 

A.  Yes. 

Q.       He  told  you  he  believed  he  had  made  a  huge 
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mess? 

A.        Yes,   he  did. 

Q.       And  he  confessed  that  he  was  emotionally 
fractured? 

A.  Yes. 

Q.       He  said  he  was  talking  to  you  as  somebody 
that  needed  moral  and  emotional  support? 
A.  Yes. 

Q.       At  this  point  he  said  he  was  trying  not  to 
end  up  killing  himself? 

A.        That  is  also  correct. 

Q.       He  told  you  that  he  was  feeling  desperate  and 
isolated? 

A.  Yes. 

Q.       He  described  himself  as  a  broken  sole? 
A.        Yes,   he  did. 

Q .       He  said  his  life  was  falling  apart  and  he 
didn't  have  anyone  to  talk  to? 
A.        Yes,   he  did. 

Q.       And  he  said  he  was  honestly  scared? 
A.       He  also  said  that. 
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Q. 


He  told  you  that  he  had  no  one  he  could 


trust? 

A.  Correct. 

Q.  And  he  told  you  he  needed  a  lot  of  help? 

A.  Yes,   he  did. 


occasions  for  pouring  out  his  heart  to  you  since  you 
were  total  strangers? 
A.  Correct. 


access  to  classified  networks  and  so  on,  incredible 
things,    awful  things,    things  that  belonged  to  the 
public  domain,   not  on  some  servers  dark  room  in 
Washington,   D.C.     What  would  you  do?     Do  you  recall  him 
asking  you  that  question? 
A.        Yes,    I  did. 

Q.        He  told  you  he  thought  that  the  information 
that  he  had  would  have  impact  on  entire  world? 
A.        That  is  also  correct. 

Q.        He  said  the  information  would  disclose 
casualty  figures  in  Iraq? 


Q. 


He  ended  up  apologizing  to  you  on  several 


Q. 


Now  at  one  point  he  asked  you  if  you  had 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/4/13  Morning  Session 

65 

A.  Yes. 

Q.  He  believed  the  State  Department,  First  World 
Countries  exploited  the  Third  World  Countries? 

A.        He  made  that  representation,  yes. 

Q.  And  he  told  you  that  the  cables  detailed  what 
was  criminal  political  fact  dealings? 

A.  Yes. 

Q.       He  believed  that  everywhere  there  was  a  U.S. 
post  there  was  a  diplomatic  scandal? 
A.        That  he  did. 

Q.       He  told  you  that  he  believed  it  was  important 
that  the  information  got  out? 
A.  Correct. 

Q.        He  thought  that  if  the  information  got  out, 
it  might  actually  change  something? 
A.  Yes. 

Q.       He  told  you  he  did  not  believe  in  good  guys 
versus  bad  guys  anymore? 
A.  Yes. 

Q.       He  only  believed  in  a  plethora  of  states 
acting  in  self-interest? 
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A.  Correct. 

Q.       He  told  you  he  thought  he  was  maybe  too 
idealistic? 

A.  Correct. 

Q.       He  told  you  that  he  was  always  a  type  of 
person  that  tried  to  investigate  to  find  out  the  truth? 

A.       Something  I  could  appreciate,  yes. 

Q.       And  based  upon  what  he  saw,   he  told  you  he 
could  not  let  information  just  stay  inside? 

A.  Yes. 

Q .       He  said  he  could  not  separate  himself  from 
others? 

A.  Correct. 

Q .       He  felt  connected  to  everybody? 
A.  Yes. 

Q.       Even  told  you  it  felt  like  we  were  all 
distant  family? 

A .        Engagement . 

Q.       And  he  said  he  cared? 

A.  Yes. 

Q.       He  told  you  that  he  thought  he  would  keep 
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track  —  keep  track  of  people  that  his  job  impacted? 
A.  Correct. 

Q.       And  he  wanted  to  make  sure  that  everybody  was 

okay? 

A.  Yes. 

Q.       He  told  you  that  the  way  he  separated  himself 
from  other  analysts  was,   he  cared  about  people? 
A.       He  said  that,  yes. 

PFC  Manning  told  you  he  followed  humanist 


Q 

values? 
A 


it? 


A. 

Q. 
A. 


Yes,   he  did. 

He  said  he  had  dogs  tags  saying  "humanist"  on 


Yes 


Do  you  know  what  it  means  to  be  a  humanist? 
From  my  understanding  the  importance  of  human 
life  and  human  beings  and  has  a  structure  of  morality . 

Q.        PFC  Manning  told  you  that  at  the  time  he  was 
feeling   (inaudible)   and  no  one  seemed  to  see  that  or 
care? 

A.  Yes. 
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Q .       He  told  you  that  he  was  bothered  that  nobody 
seemed  to  care? 

A.        Yes,   he  did. 

Q .       He  said  he  thought  apathy  was  far  worse  than 
active  participation? 
A.  Yes. 

Q.       He  told  you  that  he  preferred  the  truth 
(Inaudible) ? 

A.        Yes,   he  did. 

Q.       He  also  told  you  that  he  was  maybe  too 
traumatized  to  really  care  about  the  consequences  to 
him? 

A.  Yes. 

Q .       He  told  you  that  he  wasn ' t  brave .     He  was 

weak? 

A.  Yes. 

Q.       He  said  he  was  not  so  much  scared  of  getting 
caught  and  facing  consequences  as  he  was  of  being 
misunderstood? 

A.  Yes. 

Q .       At  one  point  you  asked  him  what  his  end  game 
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was,  correct? 

A.        Yes,    I  did. 

Q.       And  he  told  you,   hopefully  worldwide 
discussions,   debates  and  reforms? 
A.        Yes,   he  did. 

Q.       He  told  you  that  the  reaction  to  the 
(Inaudible) ? 

A.  Yes. 

Q .       And  he  said  he  wanted  people  to  see  the 
truth? 

A.  Correct. 

Q .        He  said  without  information  you  can ' t  make 
informed  decision  as  a  whole? 
A.        Yes,   he  did. 

Q.       And  he  told  you  to,    he  was  hoping  that  people 
would  actually  change  if  they  saw  the  information? 
A.  Correct. 

Q.       He  also  told  you  that  he  recognized  that  he 
may  be  just  young,   naive  and  stupid? 
A.  Yes. 

Q .       And  at  one  point  you  asked  him  why  he  didn ' t 
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just  sell  the  information  to  Russia  or  China? 
A.  Correct. 

Q.       And  he  told  you  that  the  information  belonged 
in  the  public  domain? 

A.        Yes,   he  did. 

Q.        He  believed  that  information  was  in  the 
public  domain  and  should  be  for  the  public  good? 
A.  Yes. 

Q .        You  asked  him  how  long  he  had  been  helping 
out  WikiLeaks  at  one  point? 
A.        Yes,    I  did. 

Q.       He  told  you  that  he  essentially  had  been  — 
THE  COURT:      Sustained.  Hearsay. 
MR.   COOMBS:     Very  well,    Your  Honor. 
BY  MR.  COOMBS: 

Q.       At  one  point  he  told  you  that  his  belief  or 
his  feelings  were  that  he  wanted  to  eventually  go  into 
politics? 

A.  Yes. 

Q.       And  at  the  time  he  was  thinking  that  humanity 
could  accomplish  a  lot,    if  smart  people  with  ideas 
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cooperated  with  each  other? 
A.  Correct. 

Q.       At  anytime  did  he  say  he  had  no  loyalty  to 
America? 

A.        Not  in  those  words,  no. 

Q.       At  anytime  did  he  say  the  American  flag 
didn ' t  mean  anything  to  him? 
A.  No. 

Q.       At  anytime  did  he  say  he  wanted  to  help  the 
enemy? 

A.        Not  in  those  words,  no. 

MR.   FEIN:      Thank  you.   Your  Honor. 
EXAMINATION  BY  MR.  FEIN 

BY  MR.  FEIN: 

Q.  Did  PFC  Manning  say  he  knew  Julian  Assange? 
A.        Yes,   he  did. 

Q.        Did  PFC  Manning  disclose  he  had  classified 
information,   downloaded  thousands  of  documents? 
A.        Yes,   he  did. 

Q.       Also,   Mr.   Lamo,   when  did  PFC  Manning  start 
talking  to  you,   what  day  was  that? 
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A.        On  or  about  May  20th  of  2010. 
Q.        That's  the  end  of  May  2010? 
A.  Yes. 

MR.  FEIN:  Thank  you,  Mr.  Lamo .  No  further 
questions,  Your  Honor.  Can  we  have  a  brief  recess  to 
confer? 

THE  COURT:     We  will  not  recess.      Go  ahead  and 

confer . 

(Pause) 

THE  COURT:      Lastly,    you  are  permanently 
excused.     You  are  free  to  go  or  you  can  stay  in  the 
courtroom. 

THE  WITNESS :      Thank  you . 

MR.   FEIN:     United  States  has  multiple 
stipulations  at  this  point . 

MR.   COOMBS:     Your  Honor,    could  we  take  a 
brief  ten— minute  comfort  break . 

THE  COURT :     Alright .      Court  is  in  recess 
until  11:15.     Let  me  see  you  one  moment,   both  sides,  in 
my  chambers . 

(Brief  Recess) 
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THE  COURT:     Again,   the  parties  are  present  in 
the  Court  —  there  is  an  additional  party. 

MR.   FEIN:      Captain  Whyte  is  present. 
THE  COURT :      Is  the  Government  ready  to 

proceed? 

MR.   FEIN:     We  have  three  stipulations  of 
expected  testimony.     Special  agent  Charles  Clapper,  3 
June  2013  PE27 .     Hereby  agreed   (inaudible)  accused 
defense  counsel,   trial  counsel  if  Special  Agent  Charles 
Clapper  with  present  to  testify  during  the  merits  of 
presentencing  phases  of  this  court  martial,  testify 
substantially  as  follows : 

I'm  a  special  agent  for  the  U.S.  Army 
Criminal  Investigation  Division,    CCIU.      Specifically  I 
work  for  the  CCIU  Investigative  Unit,    CCIU,    current  job 
title  special  agent  in  charge    (inaudible)   of  Arizona 
branch  office  located  in  (inaudible) 

As  the  SAC  I  run  a  two— man  office  that 
handles  exclusively  computer  crimes .     My  job  also 
entails  serving  as  CCIU's  liaison  officer  for 
additionally  liaison  officer  to  the  regional  computer 
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emergency  response  team.      That's  another  network 
operation  securities  center   (inaudible) . 

I  have  served  Arizona  Special  Agent  for 
five  years  and  I  have  been  the  SAC  for  three  of  those 
five  years.      1986  to  1999  I  was  enlisted  military 
police  officer,   MP.      I  served  as  investigation  section 
of    (inaudible)   Washington  from  1993  to  194. 

After  becoming  Agent  in    (inaudible)  19 
from  1999  to  2002  I  serves  as  computer  crimes 
coordinator  for  the  5th  MP,    (inaudible) .      I  was  also 
the  evidence  custodian  for  the    (Inaudible)    in  2001  to 
2002. 

I  served  as    (inaudible)    sergeant  in 
(inaudible)    from  2004  to  2006  CCIU  or    (inaudible) , 
Virginia.      In  2007   I  was    (inaudible)  contractor 
performing  forensic    (inaudible)    army  computer  emergency 
response  team  in   (inaudible) . 

Became    (inaudible)   Arizona  in  2008  and 
currently  serve  in  this  capacity.      I  received  bachelors 
degree    (inaudible)    located  in  New  York.      I  have  had 
extensive    (inaudible)   evidence,   handling  this  includes 
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(inaudible)   course  also  advanced   (inaudible)    in  assault 
Special  Agent  course  in  Army    (inaudible)  Georgia. 

In  terms  of  training  I  have  taken 
numerous  courses  at  the  Defense   (inaudible)  Maryland. 
Took  these  courses  between  the  year  2000  and  2008. 
They  covered  a  full  range  of   (inaudible)   and  digital 
media  collection  issues. 

Between  2003  and  2006  I  attended  two 
courses    (inaudible)    software  Reston,   Virginia.  This 
company    (inaudible)    EnCase .      In  2012   I  attended  Federal 
Law  Enforcement  Training  Center,    computer  network 
training  program  in,  Georgia. 

These  courses  all  discussed  the 
collection,   handling  of  digital  evidence.      I  have  the 
Department  of  Cyber  Certificate  from  the  DoD  which  is 
the  highest  certification  that  one  can  receive  in  the 
field. 

The  certification  must  be  renewed  every 
two  years.      I  received  my  first  certification  in  2006. 
(inaudible)    Last  October  2012.      In  addition  to  my 
training  and  certification  I  worked  for  100  cases 
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current  duty  position  in  100  and  to  200  cases  in  my 
previous  capacity . 

I    (inaudible)   evidence.     Review  custody 
also,   then  matches  evidence  attached.      I  check  for 
(Inaudible) .      I  ensure  the  appropriate  information  such 
as  dates  and  time  are  properly  recorded. 

Maintain  secure  custody  of  evidence 
prior  to  transferring  it  to  another  individual .  In 
this  particular  investigation  I  worked  with  Special 
Agent  Toni  Edwards,    assisted  with  witness  interviews 
and  handling  evidence . 

12  June  2010  I  received  evidence 
relating  to  this  investigation  from  Special  Agent 
Edwards .      I  also  received  to  consent  Form  87— signed  by 
Mr.   Lamo  on  12  June,    2010,   which  signing  consent  to  law 
enforcement  personnel  to  search  electronic  devices  for 
all  information  in  any  form  pertaining  to 
communications  which  made  in  the  form  emails,  digital 
messages,   documents,   data  communications  made,  computer 
log  files    (inaudible)   any  other  data,   encrypted  plain 
text,    any  other  format  relating  to  Bradley  E.  Manning 
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on  the  disclosure  of  classified  information  or 
information  which  property  of  the  United  States 
Government . 

The  first  piece  of  evidence  collected 
was  a  Lenovo  laptop  computer,   Fujitsu  hard  drive, 
Serial  Number  K4  0T812    (inaudible)    Item  1,    DA  Form 
marked  as  document  number  DN  7  610  known  as  (inaudible) 
hard  drive.      It  was  collected  from   (inaudible)  to 
California,    12  June. 

The  second  piece  of  evidence  was  HP  mini 
(inaudible)    computer  CN90513VT  with  computer,  hard 
drive  51E2K  recorded  4137  marked  as  document  DN7710  and 
known  as  Lamo  HP  Fujitsu  hard  drive.      It  was  collected 
(inaudible)   Mr.   Lamo  12  June  2010. 

As  I  mentioned,   both  standard  forensic 
(inaudible)    software  which  is  original  (inaudible) 
Original  information  on  hard  driver .     Using  the  DA  Form 
4137  I  properly  released  the  original  evidence  back  to 
Special  Agent  Edwards  on  14  June  2010. 

While  in  possession  of  these  items  I 
maintained  control .      I  returned  the  item  in  the  same 
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condition  that  I  received  them.      I  have  no  reason  to 
believe  that  the  evidence  was  damaged  or  contaminated 
in  any  way . 

After  releasing  the  evidence  to  Special 
Agent  Adrian  Edwards,    I  had  no  further  interaction  with 
this  evidence . 

Stipulation  expected  Gary  Young,  dated 
the  3,    June  2013  PE28.     Hereby   (inaudible)   agreed  trial 
counsel  were  present  to  testify  presentencing  phases  of 
this  court  martial  he  would  as  follows : 

I  am  currently  criminal  intelligence 
Program  Manager  CCIU.     Of  the  CID .      I  have  been  with 
CCIU  for  10  years. 

This  position  primarily  entails 
reviewing  cases  for  entering  them  into  database . 
Reports    (inaudible)   alternative  evidence  custodian. 
Alternate  evidence  custodian.      I  held  this  position  for 
10  years. 

Associates  degree,   Central  Texas 
College.     Military  1980.      '87   I  became  military  police 
investigator.     From  1989  to  1992    (inaudible)  of 
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investigation  in  Germany.      During  this  time  1989  to 
1991  I  was  also  the  evidence  custodian. 

I   joined  CID  in    (inaudible)    from  1994  to 
1995  I  was  the  alternate  evidence  custodian  while 
(inaudible)    in  career.     From  1995  to  1998  (inaudible) 
senior  enlisted  advisor  primary  evidence  custodian. 

From  1998  until  I  retired  in  2000,  I 
worked  CID  headquarters  on    (inaudible) .     After  three 
years  working  for  2003,    I  returned  to  the  criminal 
investigation  by  joining    (inaudible) .      I  have  worked  in 
my  current  since  then  serving  from  2003  to  2006 
situational  awareness  alternate  occasionally  primary 
items  custodian  at  various  times . 

Throughout  my  years  in  law  enforcement  I 
have  worked  more  than  800  cases.      In  1996  I  took  the 
medical    (inaudible)    investigation  training  by  the  Armed 
Forces  Institute  pathology  held  at  Fort  Lewis . 

In  2005  I  attended  evidence  management 
course  the  United  States  Army  Crime  Lab  in  Georgia .  In 
2007   I  returned  to    (inaudible)    lab  Special  Agent 
laboratory  training. 
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These  courses  do  cover  physical  and 
digital    (inaudible) .      I  followed  several  handling 
evidence  as  evidence  custodian .     First  time  I  receive  a 
piece  of  evidence,    I  checked   (inaudible)  evidence 
custody  document  to  make  sure  the  evidence  matches  the 
description  and  that  the  marked  for  identification 
number  on  the  evidence  matches  what  is  recorded  on  the 
form. 

I  also  check  to  make  sure  the  form  has 
been  appropriately  filled  out  and  I  sign  the  evidence 
into  the  evidence  room.      I  sign  in  the  receipt  column. 
I  then  walk  it  into  the  evidence  bought  database  before 
placing  it  in  the  evidence  room. 

When  someone  asks  to  receive  a  stored 
piece  of  evidence,    I  pull  voucher  number  and  locate  the 
evidence  in  its  appropriate  location.      I  check  to  make 
sure  the  evidence  I  am  handling  matches  the  description 
on  the  form  and  release  it  to  the  special  agent  for 
(inaudible)   that  is  requested  it. 

I  sign  that  I  have  released  it  and  the 
individual  receiving  it  signs  that  he,    that  she  has 
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received  it.     Each  time  I  relinquish  or  assume  custody 
of  evidence,    I  check  the  description,   make  sure  the 
evidence  being  transferred  matches  the  forms  used  to 
transfer.      It  in  my  capacity  as  evidence  custodian,  I 
worked  with  Special  Agent    (inaudible)   and  (inaudible) 

(inaudible) .      It's  normal  for  her  to 
sign  evidence  room  for  me  to  sign  it  back  in. 

I  am  involved  in  the  present  case 
because  my  role  in  assisting  the  investigation  team 
with  the  secure  storage  evidence  they  collected  I  have 
received  evidence  from  Special  Agent  Edwards  and 
(inaudible) . 

15  June  2010  I  received  evidence  related 
to  this  investigation  from  Special  Agent  Edwards .  I 
took  custody  of  Lenovo  laptop  computer,   Fujitsu  hard 
drive,    Serial  Number    (inaudible) .      Collected  from  Mr. 
Lamo  while  Sacramento,    California,    1  June  2010. 
Recorded  time  D4137  marked  as  document  7  6—10  and  known 
as  Lamo  hard  drive . 

I  also  took  HP  mini  computer,  number 
(inaudible)    CN90513VT  with  HP  computer  hard  drive, 
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Serial  Number    (inaudible)    collected  from  Mr.   Lamo  in 
Sacramento,    California  12  June,    2010.  (inaudible) 

Upon  taking  possession  I  logged  it  into 
the  evidence  using  proper  procedures .      I  never  logged 
it  back  out.      15  June  2010    (inaudible)   evidence  related 
to  this  investigation   (inaudible)    I  took  custody  of 
(inaudible)   VD  marked  (inaudible) 
0028-102CID221-10117DEPT  of  state  server  log, 
199.56.188.73.      Seized  on  15  June  2010.     Recorded  time 
DA  form  marked  as  DN78— 10  known  as  DOS  serve  logs. 

Taking  possession  I  walked  into  the 
evidence  room,  using  proper  procedures  I  described 
earlier .      I  never  logged  it  back  out . 

Your  Honor,    stipulation  of  expected 
testimony  from   (inaudible)   Marina,    3  June,  2013, 
Prosecution  Exhibit  29.      It  is  hereby  agreed  by  the 
(inaudible)   were  present  to  testify  during  merits 
phases  court  martial,   would  testify  essentially  as 
follows : 

I  am  the  primary  evidence  custodian  of 
the    (inaudible)      Investigation  CID  Quantico,  Virginia. 
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I  have  held  this  position  since  2006.  In  this  position 
I  track  and  catalog  evidence  maintained  by  CCIU  office. 

I  have  been  certified  evidence  custodian 
since  January  of  2006.      I  received  this  certification 
from  U.S.   Army  Criminal  Investigation  Laboratory  since 
January  2010.      I  have  also    (inaudible)  defense 
investigation  training  academy  certified  digital  media 
collector . 

I  follow  general  procedures .      The  first 
evidence  I  check  the  accompanying    (inaudible)  47 
custody  document  to  make  sure  it  matches  the 
description  and  the  marked  for  identification  over 
evidence  matches  what  is  recorded  on  the  form. 

I  also  check  to  make  sure  the  form  has 
been  properly  filled  out.      I  sign  the  evidence  to  the 
evidence  room.      I  sign  in  the  receipt  column  item  log 
it  into  evidence  book  and  database  before  preserving  it 
into  the  evidence  room. 

After  receiving  stored  piece  I  pull 
voucher  number,    locate  the  evidence  in  the  appropriate 
location.      I  check  to  make  sure  the  evidence  I'm 
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handing  over  matches  the  description  on  the  form, 
release  it  to  the  special  agent,  referring  to  the 
examiner  who  has  requested  it . 

I  sign  that  I  have  released  it  and  the 
individual  receiving  it  signs  that  he  or  she  has 
received  it .     Each  time  relinquish  or  assume  custody  of 
evidence  I  check  the  description  to  make  sure  the 
evidence  being  transferred  matches  the  form  used  to 
transfer  it . 

I  first  became  involved  in  the  present 
case  because  of  my  role  in  assisting  the  investigation 
team.      I  signed  several  piece  evidence  from  the 
investigation  agent  and  further   (inaudible)    into  the 
evidence  room  and  release  back  to  them  when  they  needed 
it  for  their  investigation  or  examination. 

In  my  role  as  evidence  custodian  I 
worked  with  and  receive  evidence  from  Special  Agent 
Kirk  Ellis,    Special  Agent  Edwards,   Davis  Shaver, 
Special  Agent    (inaudible) ,    Special  Agent  John 
(inaudible) .      I  also  know  Gary  Young.     He  used  to  be 
the  primary  evidence  custodian  when  I  began  working  for 
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Army  CCIU.     Mr.   Young  currently  serves  as    (inaudible) . 

In  June  2010,    one  Lenovo  laptop  computer 
with    (inaudible)    hard  drive,    Serial  Number  (inaudible) 
K4014    (Inaudible)    collected  from   (inaudible)    on  12 
June,    2010,    recorded  as  time  one  DA  form  4137  marked  as 
Document  Number  DN7  6— 10  and  known  as    (inaudible)  hard 
drive . 

Referring  to    (inaudible)  for 
examination.      I  also  sign  out  HP  mini    (inaudible)  CID 
hard  drive,    Serial  Number  5    (inaudible)    collected  from 
(inaudible  on  12  June    (inaudible)    DA  form  4137  marked 
as  DN77— 10  known  as    (inaudible)   HP  hard  drive  to 
Special  Agent  Shaver  for  the  same  reason. 

Returned  these  items  that  same  day.  I 
received  release  evidence  according  to  the  proper 
procedures  I  just  described.      I  did  not  alter  this 
evidence  in  any  way . 

On   (inaudible)    10  related  to 
investigation  from  Special  Agent  Wilbur  recorded  in 
Item  1  DA   (inaudible)    4137  marked  DN15 .      CD  marked 
WikiLeaks    (inaudible) ,    13  October  10    (inaudible)  from 
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Upon  receiving  this  evidence  I  properly 
logged  it  into  the  evidence  room  using  the  same 
procedures  described  earlier.     November  2010 
temporarily  released  it  to  Shaver  for  examination .  He 
returned  it  later  that  same  day.      I  (inaudible) 
released  evidence   (inaudible)   described  earlier.      I  did 
not  alter  this  evidence  in  any  way. 

On  3  November  2010,    I  received  19  pieces 
of  evidence  from   (inaudible) ,    2  November,    2010  recorded 
Items  1  through  19  on  DA  Form,    Form  4137  marked  as 
DN162-10 . 

Item  2  on  this  DA  form,    Form  4137  was  SD 
memory  card  Serial  Number    (inaudible)    SD  card. 

On  10  December  2010,    I  released  SD  card 
to  Special  Agent  Shaver  for  examination.     He  returned 
it  later  that  same  day .      I  appropriately  received  the 
evidence  back  into  the  evidence  room  according  to  the 
proper  procedures  I  described  earlier .      I  did  not  alter 
this  evidence  in  any  way . 

That ' s  the  end  of  the  three  stipulations 
of  testimony.     And  United  States  will  move  to  admit 
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what  has  been  marked  as  Prosecution  Exhibits  13  and  14 
for  identification  as  Prosecution  Exhibit  13  and  14 
respectively . 

(Pause) 

MR.   FEIN:     United  States  requests  a  lunch 
recess  a  little  earlier,    requesting  two-hour  lunch 
recess  in  order  for  the  parties  to  work  on 
administrative  issue. 

MR.   COOMBS:     No  objection,    Your  Honor. 

THE  COURT:     Alright.     We'll  come  back  at 
1345.      That  will  be  1:35  in  civilian  parlance. 

THE  COURT:      45.      I'm  sorry.      1345  or  1:45  in 
civilian  parlance.     Court  is  recessed  until  1:45. 

(The  trial  recessed  at  11:40  a.m.) 
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